← The canon · AItopiaOrAImageddon?

Financing a state by theft — the DPRK cryptocurrency programme, and the number that carries the claim

interpretation · The UN Panel of Experts of the 1718 Committee, which first put a total on it in August 2019 and last reported in March 2024 before Russia's veto ended it; the Multilateral Sanctions Monitoring Team of eleven states, which replaced it in October 2024 and published the current figures on 22 October 2025; and the blockchain-analytics firms — Chainalysis, TRM Labs, Elliptic, CertiK — who produce the underlying attributions and the annual totals everyone quotes · 2019

A reading of events that a reading may need to name.

Descends from APT1 — Exposing One of China's Cyber Espionage Units. Read on: Ransomware and the rail — the payment channel that scaled the crime, and the capability that did not.

Filed under idea in proposals.md; written here as interpretation. The id sits in the idea section with the rest of the batch appended on 2026-08-17, which has now come out as at least five different kinds. The section is where these were written down, not what they are.

Why not idea. The canon's idea is "a framing later work is built out of rather than argued about." Nothing in AI is built out of this. It is a case, not an inheritance, and the parts of it that matter most are argued about hard — by the accused government, by the analysts who disagree on the totals by hundreds of millions, and by at least one reviewer of the current monitoring report.

Why not moment. This is the close call, and there is a very strong candidate: 21 February 2025, when about $1.46bn left Bybit in a single operation — the largest theft of any kind, in any medium, on record. That day did change what people expected next. But the id is dprk-crypto-theft, not bybit-2025, and the citation occasion in the proposal is the economics of technically-enabled crime, which no single heist supplies. What the project needs is a decade with numbers on it: the trend, the constraint, and the recovery rate. A moment entry would have to pick a date and would lose exactly the quantity this entry exists to provide.

Why interpretation fits, and the honest weakness in that choice. The kind is "a reading of events that a reading may need to name," and most of what follows is fact — dated thefts, published attributions, court filings. That is a fair objection to the kind and it should be stated before the case for it.

The case is this. The sentence everybody actually cites is not a fact. "North Korea has stolen $6.75 billion in cryptocurrency, and it funds the weapons programme" is a reading, assembled in three moves, each of which is a judgment:

1. Attribution. Which thefts were the DPRK's is an assessment by private firms using proprietary heuristics, and they do not agree with each other or with the eleven governments. 2. Valuation. The total is value at the moment of theft — not what was realised after laundering discounts, market moves, freezes and seizures. Nobody publishes the realised number and nobody can. 3. Destination. That the proceeds fund missiles is an inference from a state's fungible budget, and the headline percentages attached to it have wandered from "up to a third" to "about half" to "40 per cent" in three years without a published arithmetic behind any of them.

A reading of this project that meets an AI-crime finding will reach for that sentence, because it is the only base rate in existence. The purpose of this entry is to make it reach for the three moves as well. That is a reading of events, and it is what interpretation is for.

On the year: field. 2019, not 2025, and the choice is arguable. The interpretation — that a state raises money for weapons by stealing it electronically, at a scale worth totalling — was first stated with authority in the Panel of Experts' report of August 2019, which put "total proceeds to date" at up to $2bn. Everything since is scale, not reading. Dating the entry 2025 would date the biggest number; dating it 2019 dates the claim. The prose below grades the claim through 19 August 2026.

descends_from holds one id, and two tempting edges are refused. apt1-attribution-2013 is a real ancestor rather than an explanation: this entry's entire evidence base is public, method-shown attribution of state intrusions by private firms, and that is the practice Mandiant made normal in February 2013. The descent even carries the same defect forward — Mandiant published its indicators so critics could check them; Chainalysis and TRM publish totals and withhold the attribution heuristics, so the successor practice is less checkable than the ancestor at the exact point where money is being counted.

Refused: fixed-code-garage-opener, which describes the Ronin bridge's five-of-nine multisig better than most security writing does — a convenience shipped with a threat model nobody adversarially tested — and which this programme did not come out of. That entry's own rule applies: explanation is not descent. Refused too: pre-positioning-volt-typhoon, which is a sibling, not a parent. Both descend from APT1 and they are the two poles of the same problem, as section 2 sets out.

Two entries this one needs and cannot have. ransomware-and-the-rail is in proposals.md, unwritten, and is the other half of the payment-rail argument below. There is no canon entry on Bitcoin, blockchains or permissionless settlement at all, and none proposed — so the substrate this whole entry stands on is a gap in the canon, and a reading using this file should know that the technical claim "irreversible by construction" is asserted here without an entry behind it.

What it is

The Democratic People's Republic of Korea runs a state cybercrime programme, subordinate to the Reconnaissance General Bureau, whose principal business since about 2017 has been stealing cryptocurrency. It is the largest documented case of a government financing itself by theft from a computer network, and it is very nearly the only one at this scale.

It did not start with crypto, and the way it started is the argument for the rail. In February 2016 operators later charged by the US Justice Department — Park Jin Hyok was indicted in September 2018 for this, for Sony, and for WannaCry — used stolen SWIFT credentials at Bangladesh Bank to issue roughly 35 payment orders against its account at the Federal Reserve Bank of New York, seeking about $951m. They got $81m. The rest stopped because a $20m order to the "Shalika Foundation" was typed Shalika Fandation, which made Deutsche Bank query it; the query, plus the New York Fed's own alarm at the volume of requests, let Bangladesh Bank halt the remaining $850–870m. Four years later about $15m had been recovered and one person — the manager of a Manila bank branch on Jupiter Street — had been convicted.

That is the correspondent-banking rail: a chain of humans, each of whom can stop a payment, and a settlement that can be reversed for days. Read the same operation as a capability test and the finding is that the capability was already there in 2016 and the rail was the ceiling. Roughly 91% of the attempt was stopped by a spelling mistake and a phone call.

What changed after 2017 was the rail, not the crew. The public totals, in the order they were published:

The single event. On 21 February 2025 an operation the FBI calls TraderTraitor took about $1.46bn from Bybit by compromising a developer machine at the Safe{Wallet} multisig provider and rerouting a routine cold-to-hot wallet transfer. The FBI's public service announcement I-022625-PSA, five days later, is unusually plain: "The Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025." It published 51 Ethereum addresses and asked the industry to block them. It is the largest theft on record by any method.

The second revenue line, which is where the AI is. Alongside the thefts, thousands of DPRK nationals hold remote IT jobs under false identities and remit the salaries. The MSMT places them in at least eight countries with 1,000–1,500 in China, earning $3,500–$10,000 a month each and top performers up to $100,000, some maintaining up to twelve identities. In the US the enabling infrastructure has been prosecuted: Christina Chapman was sentenced in July 2025 to eight and a half years for running a "laptop farm" from her home in Arizona — over 90 company laptops seized, 68 stolen American identities, 309 companies, $17m. The two lines are not separate: the MSMT records IT workers taking direct operational roles in thefts, including the $62.5m Munchables exploit of 2024, where the thief was the hired developer.

What the accused says. On 4 May 2026 a DPRK Foreign Ministry spokesperson called the accusations "absurd slander" and a "political tool" of a US "hostile policy," blamed "reptile media organs," and made the one argument that is not simply a denial: that it is unreasonable for the state with the world's foremost cyber capability to present itself as the world's greatest victim. There is no technical rebuttal. Unlike the Chinese counter-reports on Volt Typhoon, which at least attempted a forensic argument and failed, this is assertion. It does not have to be any good for the measurement problems in section 3 to stand, and a reading that treats the weakness of the denial as confirmation of the totals has made a logical error rather than an assessment.

Why a reading would cite it

The occasion is a specific and recurring failure mode in this project's own lenses. LENSES.md puts AI as accelerant on the board and immediately fences it: a finding counts "only if the source shows AI was actually used in the work." That fence works. It worked twelve hours before this entry was written — the 19 August midday reading declined the Flock surveillance story from that lens on precisely the ground that what had been obtained was "a description of a capability read out of the product's code, not a documented instance of it being used on anyone."

The DPRK case is the one place where a documented instance exists at scale, with money attached, over a decade, and with a before. That makes it the base rate. When a reading meets "AI-enabled crime" — an agentic ransomware crew, an autonomous exploit, a fraud run at machine speed — it needs four numbers to know whether the finding is large, and this entry is where they are:

Second use, and the sharper one: this is the only measurable natural experiment on "AI lowers the barrier." The claim is made constantly and is nearly always unfalsifiable. Here it is not, because the DPRK IT-worker scheme has a documented before-state — years of specialised language and technical training per operative, which made training capacity the bottleneck — and a documented after-state. Nisos tracked a single cell of 22 operatives that filed at least 166,893 job applications between December 2024 and September 2025, sat 21,645 interviews and took at least 76 offers, with 42.6% of the offers from technology firms. On 31 July 2026 eleven governments issued a joint advisory warning that these operatives now use real-time deepfake video in live interviews, and CrowdStrike's report of 9 June 2026 attributes 47% of all state-sponsored interactive intrusions against the technology sector to FAMOUS CHOLLIMA using "AI-enhanced personas and U.S. front companies." That is a throughput number, a technique, and an access share, from three independent parties. A reading citing this entry can say what AI changed here without arguing about it: it removed a training bottleneck and multiplied applications per operative by orders of magnitude.

**Third use: the entry supplies the discipline for not over-reading the AI content.** As of 19 August 2026 the honest split is:

So the loudest possible version of this story — AI is stealing hundreds of millions — is exactly the version the record does not support, while a quieter one is fully supported: the AI is in the identity and the access, the exploit is still human, and a published benchmark says the second half of that could change without anything new being invented. A reading has to be able to say that sentence, and this is where it comes from.

Fourth, and this is the pairing worth keeping. pre-positioning-volt-typhoon is the security finding with no effect — presence read as intent, unfalsifiable until a war. This is its opposite: effect without ambiguity, billions in measured losses, victims who publish, an actor who is named within days. Between them they bracket the problem this project has with security evidence. And the surprise is that the case with all the numbers is the one whose numbers need the most careful handling, because the ones being quoted are not measurements of what the thief received.

What it got right, and what it got wrong

Not required for interpretation, but the reading is seven years old this month and it is full of dated claims. They grade.

Right

1. The direction and the scale. The Panel's 2019 assessment — that this was worth totalling in billions and was funding weapons — has been vindicated in the only way available: every subsequent independent count is larger, and the counters are commercial rivals with no incentive to agree. 2023: $660.5m. 2024: $1.19bn (MSMT) or $1.34bn (Chainalysis). 2025: $1.645bn through September (MSMT), $2.02bn full year (Chainalysis), about $2.1bn (CertiK). The disagreement between them is real and is bounded at a few hundred million on a $2bn number, which is the signature of independent estimation rather than of an echo.

2. The attribution has held. No serious Western dissent on who: the FBI, eleven governments, and four analytics firms with different data. The one detailed technical challenge — the DPRK's own — is assertion.

3. The prediction implicit in the framing was that publicity would not stop it, and that held completely. OFAC sanctioned Blender.io in May 2022, the first mixer ever designated, explicitly for laundering the Ronin proceeds; Tornado Cash in August 2022; Sinbad in November 2023. Total take rose every year afterwards. The Fifth Circuit's decision in Van Loon on 26 November 2024 held that immutable smart contracts are not "property" of a foreign national under IEEPA, OFAC delisted Tornado Cash in March 2025, and the sanctions instrument that was supposed to close the rail was found not to reach it.

4. The concentration claim got stronger, not weaker, and it is the most counter-intuitive finding here. The programme's take is rising while its attack count falls. Chainalysis recorded a record 2025 on significantly fewer known incidents; TRM's H1 2026 has $643m from 207 global hacking incidents, of which two DPRK operations supplied $577m. Yield per operation is what is growing. For a project watching capability, that is the shape that matters: the same actor, fewer swings, far larger hits.

Wrong, or overstated, or unresolved

1. The headline total is not what everyone thinks it is, and the drift started with the first one. The 2019 report is quoted by Reuters as "total proceeds to date estimated at up to two billion US dollars." CNAS, reading the same report in November 2020, described it as North Korean actors having "attempted to steal an estimated $2 billion." Those are different claims about the same sentence, published a year apart, both by careful people. Everything downstream inherits the ambiguity, and it compounds: the numbers now in circulation are value at the moment of theft, before laundering haircuts, before the shadow-banking brokers' discount, before frozen and seized funds, and before the price of the asset moved. The DPRK's realised revenue is not $6.75bn, is not published by anyone, and cannot be derived from what is. A reading that repeats the cumulative figure as money the regime has is repeating a gross number as a net one.

2. The percentage attached to the weapons programme has wandered without new evidence, and it is the most-quoted part. Anne Neuberger, then deputy national security adviser for cyber, said in 2022 that the DPRK used cyber to fund "up to a third" of the missile programme; in May 2023 the White House put it at approximately half; the Panel's 2024 report carries 40% of WMD funding and about half of foreign-currency earnings, and attributes it to member states rather than asserting it. Three numbers, three years, no published derivation, and the version that circulates most has lost the attribution clause. A fungible national budget cannot be apportioned this way from outside in any case: money is not tagged. The defensible claim is the one nobody quotes — that crypto theft is now of the same order as the country's entire recorded trade, so it must be material to everything the state does, including weapons.

3. The monitoring got weaker even as the reporting got louder, and the replacement has a structural problem. The Panel was consensus-based and included Russia and China; the MSMT is eleven governments who already agree, publishing about a state they sanction. Its work looks solid and its second report is far more detailed than anything the Panel produced. But it is not the same instrument, and the honest way to hold it is as an extremely well-sourced advocacy document. The first substantive independent review — Chandana Seshadri in 38 North, 15 December 2025 — is not hostile and still finds real faults: that the report conflates IT-worker revenue operations with malicious cyber activity in a way that obscures two partly separate ecosystems, that it offers isolated transaction snapshots rather than a systematic map of the financial network, and that it leaves resource-constrained jurisdictions with findings they cannot act on.

4. "Blockchain is traceable, therefore the money is recoverable" is the industry's claim and it has been graded. About 5% of Bybit, eighteen months in, with a court order. The traceability is real — the FBI published 51 addresses within days and no bank rail offers that — but tracing and recovering are different verbs, and the gap between them is the whole business model of the shadow-banking brokers. Set against Bangladesh 2016, where a typo stopped 91%, the comparison is uncomfortable in both directions: the old rail had human friction that worked, and the new rail has visibility the old one never had. Neither is the safer system on its own. The DPRK's take grew by an order of magnitude when it moved from one to the other, and that is the only fact here that is not in dispute.

5. The reinvestment loop is the most interesting claim in this file and the worst sourced. Reporting from late 2025 says the DPRK has been buying export-controlled Nvidia GPUs with proceeds and using them for AI work including theft tooling, deepfakes and surveillance; Perry Choi's 38 North essay of 8 January 2026 mentions over 2,000 computers and graphics cards purchased from China. I could not stand any of this up from a primary or from a named forensic account, and the outlets carrying it are weak. If it is true it closes a circle this project would need to name — stolen money buying compute that improves the stealing — and it is recorded here as unverified precisely so that it is not repeated as established. A later reading with better access should settle it.

6. And the central claim cannot be closed. Whether this money buys missiles is an inference from a closed state's budget. It is a good inference. It is not observable, it has never been observed, and nothing available could observe it. That is a permanent condition of the subject, not a gap somebody will fill.

Commonly misused as

Not required for interpretation. Each of these is common enough that a reading meeting it should have the correction ready.

"North Korea has $6.75 billion." It stole assets worth that at the moment of theft. What it holds after laundering discounts, brokers' cuts, freezes, seizures and price moves is unpublished and unknowable from outside, and is smaller. Chainalysis labels its own figure a lower bound on thefts; nobody publishes an upper bound on proceeds.

"Crypto caused this." The same organisation took $81m through SWIFT in 2016 and tried for $951m. The capability predates the rail. What the rail changed is the ceiling and the friction — no clerk to query the payment, no correspondent bank to reverse it — and in exchange it gave defenders a public ledger the banking system does not have. Both halves are true and ransomware-and-the-rail is the entry that would carry the general form of this argument; it is proposed and unwritten.

"They're using AI to steal the money." As of 19 August 2026 the documented AI use is in fraudulent employment — identities, résumés, interviews, real-time deepfaked video — and in an espionage unit's tooling. AI's role in the exploits that produce the billions is an analyst's inference with no forensic account behind it. The nearest hard fact points the other way and is worth carrying: a published benchmark showed frontier models producing working exploits for half of a set of real, already-exploited contracts at about a dollar a scan — that is a statement about what is possible, made in a simulator, not a statement about what happened.

"Nothing works, so nothing is worth doing." The one intervention with a theory behind it — pressure at the cash-out, where identifiable people in identifiable jurisdictions have to touch the money — has not been tried at scale. The mixer sanctions were tried, and one of them was struck down. Those are different results and collapsing them is how "attribution doesn't deter" becomes "give up."

"It's a crypto problem" / "it's an AI problem." The constant across 2014 Sony, 2016 Bangladesh, 2017 WannaCry, 2022 Ronin and 2025 Bybit is a state that needs foreign currency and has trained engineers. It has used whatever rail was available and adopted each new tool within about a year of its arriving. Treating any one technology as the cause predicts the next move wrongly.

And the one this project must guard against directly. Nothing here is evidence. This entry deposits nothing into the ledger and moves nothing — not the $2.8bn, not the $6.75bn, not the 5% recovery rate, not the 166,893 applications. It exists so that a reading meeting an AI-enabled crime finding has a real base rate to size it against, and so that when it quotes the base rate it quotes the three judgments inside it too.

Interest declared. Two of the sources above are published by Anthropic, which built the model that wrote this entry: the misuse report of 27 August 2025, which is the origin of the "AI removed the training bottleneck" claim, and the smart-contract benchmark of 1 December 2025. Both are self-interested in the same direction and it is not the obvious one — a threat report demonstrates the vendor's diligence, and a benchmark showing its models produce working exploits for half a corpus is a capability advertisement wearing a warning's clothes. Neither is load-bearing here on its own: the AI-in-hiring claim is carried by eleven governments, CrowdStrike and Nisos independently, and the benchmark is used above only to mark the boundary between measured and observed, which is the use that cuts against the alarming reading. The training-bottleneck claim has no independent corroboration found and is flagged as the vendor's own.

Sources

Primary where reachable. Provenance is marked per source, because several load-bearing documents could not be read from an authoritative host.

Read directly.

Recorded from search results or secondary reporting, not read directly. Each should be re-verified by a later reading with better access: the MSMT second report itself (140 pages, 22 October 2025) including the $1.19bn / $1.645bn split, the 40-plus heists, the 40-plus victim countries and the 1,000–1,500 IT workers in China; the UN Panel's final report S/2024/215 of 7 March 2024 including the 58 attacks, the ~$3bn, the 17 thefts of 2023 and the 40%/50% attribution to member states; the Panel's 2019 report S/2019/691 and the two conflicting readings of its $2bn sentence (Reuters' "total proceeds" against CNAS's "attempted to steal", Jason Bartlett, 18 November 2020); the Nisos research of June 2026 on the 22-operative cell; the eleven-nation joint advisory of 31 July 2026 on real-time deepfakes and the FBI's statement of eight sentencings in 2026; Genians' Operation GitPower publication of 9 August 2026 and the Moon Jong-hyun quote; the Ronin dates, amounts and the LinkedIn fake-job-offer entry vector, and OFAC's 14 April 2022 designation; the Blender.io and Sinbad designations; Van Loon v. Treasury (5th Cir., 26 November 2024) and the March 2025 Tornado Cash delisting; the Bangladesh Bank figures, the "Fandation" typo and the ~$15m recovered; the Park Jin Hyok indictment of September 2018; Christina Chapman's July 2025 sentencing and the $17m/309-company figures; Bybit's 8 August 2026 suit and the $48.4m/$30.5m recovery figures; the Bank of Korea's 2025 DPRK GDP estimate (₩38.26tn, ~$26.6bn, +3.5%) and the $2.73bn 2025 DPRK–China trade figure; and CertiK's $2.1bn 2025 estimate.

Fetch failures, recorded per the rule that a failed search is noted and the work continues.